The vulnerability identified as CVE-2026-39690 affects the Paul Bearne Author Avatars List/Block plugin versions up to 2.1.25. It is a missing authorization issue where access control security levels are incorrectly configured, potentially allowing unauthorized access or actions within the plugin. No CVSS score or detailed technical exploit information is provided. No official patch or remediation level has been disclosed by the vendor or authoritative sources. The vulnerability is not related to a cloud service and no known active exploitation has been reported.

The impact of this vulnerability is unauthorized access or actions due to missing authorization checks in the plugin. This could lead to unauthorized users manipulating or accessing author avatar lists or blocks. However, no specific exploitation or damage scenarios are documented, and no known exploits are currently in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor vendor communications for updates. Until a patch is available, restricting access to the affected plugin or disabling it if feasible may reduce risk.